系统完整性工具
留个课题，想研究一下MBR。基于Openswan的VPN实现方法。一端静态ip，一端adsl的动态ip.
[
| 
2007/09/10 18:10]
| 2007/09/10 18:10]
最近工作关系，有幸研究了一下VPN的东西，做了一些东西，现记录下来。是基于ipsec的openswan。
简单说明的是：已经实现，尚需完善。相信很多朋友的公司都是这种结构，公司的总部是固定IP，分公司是ADSL。所以当重新拨号，IP变化时就需要重新修改配置文件ipsec.conf中的right、rightnexthop字段。以后考虑自动处理这部分。
参考链接：
1：http://www.linuxhomenetworking.com/wiki/index.php/Quick_HOWTO_:_Ch35_:_Configuring_Linux_VPNs#Protected_Interface_TCPDUMP_Output_From_.22vpn2.22
2：http://wzwanghai.spaces.live.com/blog/cns!56626E237AFBD116!172.entry
实测试环境如下：静态IP（总部/Left） + ADSL（分公司/Right）
操作系统：ubuntu server 6.06
网络图：
===static ip --- Internet route --- ADSL IP ===
192.168.80.0/24===222.92.109.231---222.92.109.225...221.225.48.1---221.225.48.25===192.168.101.0/24
Left LAN ===Left Gateway ---leftnexthop ...rightnexthop---Right Gateway===Right LAN
简述安装过程：安装系统 ubuntu,然后apt-get install openswan就算安装完毕。主要配置部分就是openswan的配置文件/etc/ipsec.conf,/etc/ipsec.secrets，再就是iptables的NAT部分。
1：系统安装略 下面将总部的服务器简称为LS(left server),分支的服务器为RS（right server）.分别安装openswan
apt-get install openswan
说明：
1:Do you wish to enable opportunistic encryption in Openswan? 选：no
2:Do you want to create a RSA public/private keypair for this host ? 选：no
如上操作后，退出
2：创建编辑/etc/ipsec.conf,/etc/ipsec.secrets,如无特别说明，都是双机上同时操作。
rm /dev/random
ln -s /dev/urandom /dev/random
ipsec newhostkey --output /etc/ipsec.secrets
注意：rm和ln -s的目的是为了第三步的ipsec操作节省时间。详细的关于/dev/random和/dev/urandom.见参考链接2，google关键字是：/dev/random /dev/urandom 区别
另可以通过 man urandom找到相关信息。
样例文件/etc/ipsec.secrets
: RSA {
# RSA 2192 bits kook.glfsoft.com Fri Sep 7 18:30:22 2007
# for signatures only, UNSAFE FOR ENCRYPTION
#pubkey=0sAQO8thd0/Khbyv6h77C/cCN/RT5g96clCaRggRMv6gDOUwCoMspjLhbuSBQaMcFauCjd25sDKQcHSiNzGRo2c6dq9r3hGWz3p5RGIqA+ro/L/LRWgHa6xH++NPV1AZ/6wwxZ+HC15SymagsrJg5OtdbLMhvNT2gN0qGBROl12BGru7WFLNr8zQkoCcL4nx2SgN02S3Xl34S2/eDXRoo7MvMdfrYKzbTf+V5rEe3hxesEudBqssdn8NUbm1mF5piOzbMymTU+NGmzkYbiGDVhQwr9kfIbjhaLtr9ntpI36ISLVKe4PHr+cll25hQn5ZFqmBhYceuvx2G4n2qKIOoBEGDq39pZxqkN1LI2SgD4N1Ez4LZN
Modulus: 0xbcb61774fca85bcafea1efb0bf70237f453e60f7a72509a46081132fea00ce5300a832ca632e16ee48141a31c15ab828dddb9b032907074a2373191a3673a76af6bde1196cf7a7944622a03eae8fcbfcb4568076bac47fbe34f575019ffac30c59f870b5e52ca66a0b2b260e4eb5d6cb321bcd4f680dd2a18144e975d811abbbb5852cdafccd092809c2f89f1d9280dd364b75e5df84b6fde0d7468a3b32f31d7eb60acdb4dff95e6b11ede1c5eb04b9d06ab2c767f0d51b9b5985e6988ecdb33299353e3469b39186e2183561430afd91f21b8e168bb6bf67b69237e8848b54a7b83c7afe725976e61427e5916a98185871ebafc761b89f6a8a20ea011060eadfda59c6a90dd4b2364a00f8375133e0b64d
PublicExponent: 0x03
# everything after this point is secret
PrivateExponent: 0x1f73ae937f7164a1d51afd481fe805ea8b8a657e9bdb819b656ad887fc5577b8801c08771087ae7d0c0359b2f58f1eb17a4f448086d6813705e8842f09134691d3ca502ee77e9bee0bb0700a726d4caa1e0e6abe7476154a5e28e8d59aa9cb2cb9a9681e50dcc66701dc8657b7c8f921ddaf4ce29157a31aeae0d193a402f1f49e40dccf2a222c3156ac8bd34c4d7816891d2d04e651894997e073fca08ddb0611937457af8669e994345473a0aed4a01b2017f5a326cba2f28969870f4c0783eb47fb376444e9674e00ae01dda55480ebed2e8af1d16670c978a5d5ca8a0fc508f92e8990d85e8225f247a6662ef19dcf80d3304c3d92784170d1aac26cc256aa5d9b11adfebeaf353ca0d31e4c2fbbf80b
Prime1: 0xe09a487c9a72d977226e6f810f53ef0748dace2b75e8e300bd94a5fbfdfd1e0bc0381534d55441600abe3b7f8177a74740c68404f23ca49c76c1f4d0793f58ef5f0d5d7aae3e83558449c9c239c065d3809aa7259e316be4448029e74c392365508d2166da5a6c7c1b9b817d6e836e9ef986cadfea3a019ef3f3e90bf853b7dea7d580f6fe9e53009d
Prime2: 0xd71762d7273d7c8879f958f88c2b554a4bb3d04c69e8161483bc199bbb80c6e617bb16ccfcb4b7cd9f64ca158697a2a4e0463837d463f712728ffd0a52fbccc37ef6ccb4b4d174b4deba82a9698fb4db62148e03a9fb4a8d9ca517b213e9469d15ecddc57693f8ff515d0c8081c65f42ebb01e929998e142b4c373891d08df183666848a897725e571
Exponent1: 0x95bc305311a1e64f6c499fab5f8d4a04db3c89724e9b42007e631952a953695d2ad00e2338e2d64007297cffaba51a2f808458034c286dbda4814de050d4e5f4ea08e8fc7429ace3ad8686817bd59937ab11c4c3becb9d42d8557144dd7b6cee35b36b99e6e6f2fd67bd00fe49acf469fbaf31ea9c26abbf4d4d4607fae27a946fe3ab4f54698cab13
Exponent2: 0x8f64ec8f6f7e5305a6a63b505d7238dc3277e032f145640dad2811127d00849965276488a8787a8914eddc0e59ba6c6dead97acfe2ed4f61a1b5535c3752888254a48878788ba3233f2701c6465fcde796b85ead1bfcdc5e686e0fcc0d462f1363f33e83a462a5ff8b935dab012eea2c9d201461bbbb40d7232cf7b0be05ea102444585c5ba4c3ee4b
Coefficient: 0x8dad8bbc23387a2237593246b204be082fd21c61d65ffa0319b208bab95dee4a2e47e82fff7b8033201d8c17e6901923e7eba59cbf74162b49e5ca01f88986cc691680dafdea6d3be3e06f4f88e2de4f496171193bb4a63b0d776b15f4d675b98646590b40d58b3f55cd2034c1c2e521459aacecef5103b5c6f38535b9367ea3f4ca7dc79426b3e383
}
# do not change the indenting of that "}"
下面创建/etc/ipsec.conf文件，如果你对于ssh的不用密码登录，并且做过集群的用户等效的话，这里的配置文件创建方式是类似的。
下面的文件是双机一样的。样例文件如下：
version 2.0
include /etc/ipsec.d/examples/no_oe.conf
config setup
nat_traversal=yes
plutostderrlog=/var/log/pluto.log
conn test
keyingtries=%forever
authby=rsasig
auto=start
left=222.92.109.231
leftsubnet=192.168.80.0/24
leftnexthop=222.92.109.225
leftrsasigkey=0sAQOPAsHPXj2/glopuY+KCsHvZS8QpMzsRS7NmjjgtQxJALyoyetV+/8+iT8EFWArelly2iC2LtK3ZWEgW1nS92qHJdeuX+vVX6dwdhxIodcfP7Lti73MadZnmU+JQRLUsHYK9u+pbJGksIrOIgMJnWsxrwpK4kGp5GuRWtpd13EuJkPWb+3lbpaofX9JwsLSgn0q+ZD5nccwhaiXTshDCT/UinE9teqoO7JbVvmooPcjEWktsnJ22u9gbs0m6KeGthx9TJJPGg0fZKWXVhuID+Mv2zdUwwPVk5EHjKeZ5f74+D9YSxJxITcEBMtDQTrH87RPyz8bX/q5Qq1iZ56JbjPdPm0+knvgLRYDLBPSRIylUs5p
right=61.155.208.3
rightsubnet=192.168.101.0/24
rightnexthop=61.155.208.1
rightrsasigkey=0sAQO8thd0/Khbyv6h77C/cCN/RT5g96clCaRggRMv6gDOUwCoMspjLhbuSBQaMcFauCjd25sDKQcHSiNzGRo2c6dq9r3hGWz3p5RGIqA+ro/L/LRWgHa6xH++NPV1AZ/6wwxZ+HC15SymagsrJg5OtdbLMhvNT2gN0qGBROl12BGru7WFLNr8zQkoCcL4nx2SgN02S3Xl34S2/eDXRoo7MvMdfrYKzbTf+V5rEe3hxesEudBqssdn8NUbm1mF5piOzbMymTU+NGmzkYbiGDVhQwr9kfIbjhaLtr9ntpI36ISLVKe4PHr+cll25hQn5ZFqmBhYceuvx2G4n2qKIOoBEGDq39pZxqkN1LI2SgD4N1Ez4LZN
文件比较简单，很容易看懂。下面简单介绍一下主要字段的产生。这个配置文件，结合上门的那个图看一下。是非常容易的。
主要介绍leftrsasigkey、rightrsasigkey的产生方法。注意匹配。避免在left server上产生right key的情况。
root@LS:~# ipsec showhostkey --left
# RSA 2192 bits dmz-nat Fri Sep 7 18:32:24 2007
leftrsasigkey=0sAQOPAsHPXj2/glopuY+KCsHvZS8QpMzsRS7NmjjgtQxJALyoyetV+/8+iT8EFWArelly2iC2LtK3ZWEgW1nS92qHJdeuX+vVX6dwdhxIodcfP7Lti73MadZnmU+JQRLUsHYK9u+pbJGksIrOIgMJnWsxrwpK4kGp5GuRWtpd13EuJkPWb+3lbpaofX9JwsLSgn0q+ZD5nccwhaiXTshDCT/UinE9teqoO7JbVvmooPcjEWktsnJ22u9gbs0m6KeGthx9TJJPGg0fZKWXVhuID+Mv2zdUwwPVk5EHjKeZ5f74+D9YSxJxITcEBMtDQTrH87RPyz8bX/q5Qq1iZ56JbjPdPm0+knvgLRYDLBPSRIylUs5p
root@RS:~# ipsec showhostkey --right
# RSA 2192 bits kook.glfsoft.com Fri Sep 7 18:30:22 2007
rightrsasigkey=0sAQO8thd0/Khbyv6h77C/cCN/RT5g96clCaRggRMv6gDOUwCoMspjLhbuSBQaMcFauCjd25sDKQcHSiNzGRo2c6dq9r3hGWz3p5RGIqA+ro/L/LRWgHa6xH++NPV1AZ/6wwxZ+HC15SymagsrJg5OtdbLMhvNT2gN0qGBROl12BGru7WFLNr8zQkoCcL4nx2SgN02S3Xl34S2/eDXRoo7MvMdfrYKzbTf+V5rEe3hxesEudBqssdn8NUbm1mF5piOzbMymTU+NGmzkYbiGDVhQwr9kfIbjhaLtr9ntpI36ISLVKe4PHr+cll25hQn5ZFqmBhYceuvx2G4n2qKIOoBEGDq39pZxqkN1LI2SgD4N1Ez4LZN
至于本机地址ifconfig获取吧。上层网关可以，rounte -n,或者netstat -nr都可以。但是，我发现我的ADSL的网关很奇怪。只能通过ifconfig去找到它。
下面那个P-t-P:221.225.48.1就是了。
root@RS:~# ifconfig
eth0 Link encap:Ethernet HWaddr 00:0B:6A:DF:B5:AC
inet addr:192.168.101.56 Bcast:192.168.101.255 Mask:255.255.255.0
inet6 addr: fe80::20b:6aff:fedf:b5ac/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:81153 errors:0 dropped:0 overruns:0 frame:0
TX packets:52649 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:16653279 (15.8 MiB) TX bytes:11039593 (10.5 MiB)
Interrupt:201 Base address:0x2f00
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:0 (0.0 b) TX bytes:0 (0.0 b)
ppp0 Link encap:Point-to-Point Protocol
inet addr:221.225.48.25 P-t-P:221.225.48.1 Mask:255.255.255.255
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1492 Metric:1
RX packets:21954 errors:0 dropped:0 overruns:0 frame:0
TX packets:27591 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:3
RX bytes:7751933 (7.3 MiB) TX bytes:3933420 (3.7 MiB)
启动服务的相关命令：/etc/init.d/ipsec start | stop ｜ restart | status
3:iptables的Nat调整。双向都要修改。
估计很多人的NAT都是简单方式，如下：
-A POSTROUTING -o eth0 -j MASQUERADE
-A POSTROUTING -o ppp0 -j MASQUERADE
需要修改为
-A POSTROUTING -s 192.168.80.0/255.255.255.0 -d ! 192.168.101.0/255.255.255.0 -o eth0 -j MASQUERADE
-A POSTROUTING -s 192.168.101.0/255.255.255.0 -d ! 192.168.80.0/255.255.255.0 -o ppp0 -j MASQUERADE
样例文件如下：
1:Left Server的iptabels-save文件。
# Generated by iptables-save v1.3.3 on Fri Sep 7 21:24:26 2007
*filter
:INPUT ACCEPT [140622:6765274]
:FORWARD ACCEPT [30212:2076096]
:OUTPUT ACCEPT [250897:56479961]
COMMIT
# Completed on Fri Sep 7 21:24:26 2007
# Generated by iptables-save v1.3.3 on Fri Sep 7 21:24:26 2007
*nat
:PREROUTING ACCEPT [11567:739516]
:POSTROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [110:32696]
-A POSTROUTING -s 192.168.80.0/255.255.255.0 -d ! 192.168.101.0/255.255.255.0 -o eth0 -j MASQUERADE
COMMIT
# Completed on Fri Sep 7 21:24:26 2007
2:Right Server的iptables-save文件
# Generated by iptables-save v1.3.3 on Mon Sep 10 10:02:37 2007
*nat
:PREROUTING ACCEPT [18:2527]
:POSTROUTING ACCEPT [1:108]
:OUTPUT ACCEPT [1:108]
-A POSTROUTING -s 192.168.101.0/255.255.255.0 -d ! 192.168.80.0/255.255.255.0 -o ppp0 -j MASQUERADE
COMMIT
# Completed on Mon Sep 10 10:02:37 2007
# Generated by iptables-save v1.3.3 on Mon Sep 10 10:02:37 2007
*filter
:INPUT ACCEPT [56:7136]
:FORWARD ACCEPT [11:676]
:OUTPUT ACCEPT [20:1856]
-A FORWARD -o ppp0 -p tcp -m tcp --tcp-flags SYN,RST SYN -m tcpmss --mss 1400:1536 -j TCPMSS --clamp-mss-to-pmtu
COMMIT
# Completed on Mon Sep 10 10:02:37 2007
对了，记得打开内核的转发。如果你本来已经做Nat的话，肯定已经修改了。双机执行如下：
root@LS:~# vi /etc/sysctl.conf
......
net/ipv4/ip_forward=1
......
root@LS:~# sysctl -p
4：查看状态,参考链接1.日志文件/var/log/pluto.log，及相关命令。
root@LS:~# tail -f /var/log/pluto.log
root@LS:~# ipsec barf (产生超多信息，barf是呕吐的意思，估计把能吐的都吐了。呵呵。)
root@LS:~# ipsec auto --status
root@LS:~# tcpdump -n -i eth0 icmp
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes
06:11:36.835395 IP 192.168.101.24 > 192.168.80.10: ICMP echo request, id 768, seq 4909, length 40
06:11:37.827897 IP 192.168.101.24 > 192.168.80.10: ICMP echo request, id 768, seq 5165, length 40
06:11:38.819993 IP 192.168.101.24 > 192.168.80.10: ICMP echo request, id 768, seq 5421, length 40
06:11:39.833482 IP 192.168.101.24 > 192.168.80.10: ICMP echo request, id 768, seq 5677, length 40
06:11:40.840780 IP 192.168.101.24 > 192.168.80.10: ICMP echo request, id 768, seq 5933, length 40
06:11:41.877138 IP 192.168.101.24 > 192.168.80.10: ICMP echo request, id 768, seq 6189, length 40
06:11:42.877428 IP 192.168.101.24 > 192.168.80.10: ICMP echo request, id 768, seq 6445, length 40
06:11:43.882809 IP 192.168.101.24 > 192.168.80.10: ICMP echo request, id 768, seq 6701, length 40
06:11:44.875519 IP 192.168.101.24 > 192.168.80.10: ICMP echo request, id 768, seq 6957, length 40
06:11:45.831237 IP 192.168.101.24 > 192.168.80.10: ICMP echo request, id 768, seq 7213, length 40
06:11:46.856197 IP 192.168.101.24 > 192.168.80.10: ICMP echo request, id 768, seq 7469, length 40
06:11:47.853919 IP 192.168.101.24 > 192.168.80.10: ICMP echo request, id 768, seq 7725, length 40
root@RS:~# tcpdump -n -i ppp0 icmp
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on ppp0, link-type LINUX_SLL (Linux cooked), capture size 96 bytes
18:11:56.725896 IP 192.168.80.10 > 192.168.101.24: ICMP echo reply, id 768, seq 30252, length 40
18:11:57.584298 IP 192.168.80.10 > 192.168.101.24: ICMP echo request, id 55062, seq 5, length 64
18:11:57.726368 IP 192.168.80.10 > 192.168.101.24: ICMP echo reply, id 768, seq 30508, length 40
18:11:58.594890 IP 192.168.80.10 > 192.168.101.24: ICMP echo request, id 55062, seq 6, length 64
18:11:58.728961 IP 192.168.80.10 > 192.168.101.24: ICMP echo reply, id 768, seq 30764, length 40
18:11:59.593563 IP 192.168.80.10 > 192.168.101.24: ICMP echo request, id 55062, seq 7, length 64
18:11:59.729572 IP 192.168.80.10 > 192.168.101.24: ICMP echo reply, id 768, seq 31020, length 40
18:12:00.604153 IP 192.168.80.10 > 192.168.101.24: ICMP echo request, id 55062, seq 8, length 64
18:12:00.732140 IP 192.168.80.10 > 192.168.101.24: ICMP echo reply, id 768, seq 31276, length 40
18:12:01.604707 IP 192.168.80.10 > 192.168.101.24: ICMP echo request, id 55062, seq 9, length 64
18:12:01.732756 IP 192.168.80.10 > 192.168.101.24: ICMP echo reply, id 768, seq 31532, length 40
18:12:02.615272 IP 192.168.80.10 > 192.168.101.24: ICMP echo request, id 55062, seq 10, length 64
18:12:02.735372 IP 192.168.80.10 > 192.168.101.24: ICMP echo reply, id 768, seq 31788, length 40
18:12:03.623941 IP 192.168.80.10 > 192.168.101.24: ICMP echo request, id 55062, seq 11, length 64
18:12:03.735966 IP 192.168.80.10 > 192.168.101.24: ICMP echo reply, id 768, seq 32044, length 40
有趣的事情：当我采用了错误的iptable策略时，无法ping通，重新使用正确的策略，仍然无法ping通。
但是我换一个内网地址ping的话，就立即ping通了。奇怪的现象。需要想想为什么。
本文链接：http://www.52zhe.cn/read.php/94.htm
本文作者：kook（若就博客内所涉及的技术问题交流，请用下面的MSN或Gmail联系我)
联系方式：(MSN:kook#live.com) (Google talk:kookliu)
没有版权：GNU，转载时请注明“转载人”欠本人一顿饭，来日见面之时兑现！谢谢合作！
简单说明的是：已经实现，尚需完善。相信很多朋友的公司都是这种结构，公司的总部是固定IP，分公司是ADSL。所以当重新拨号，IP变化时就需要重新修改配置文件ipsec.conf中的right、rightnexthop字段。以后考虑自动处理这部分。
参考链接：
1：http://www.linuxhomenetworking.com/wiki/index.php/Quick_HOWTO_:_Ch35_:_Configuring_Linux_VPNs#Protected_Interface_TCPDUMP_Output_From_.22vpn2.22
2：http://wzwanghai.spaces.live.com/blog/cns!56626E237AFBD116!172.entry
实测试环境如下：静态IP（总部/Left） + ADSL（分公司/Right）
操作系统：ubuntu server 6.06
网络图：
===static ip --- Internet route --- ADSL IP ===
192.168.80.0/24===222.92.109.231---222.92.109.225...221.225.48.1---221.225.48.25===192.168.101.0/24
Left LAN ===Left Gateway ---leftnexthop ...rightnexthop---Right Gateway===Right LAN
简述安装过程：安装系统 ubuntu,然后apt-get install openswan就算安装完毕。主要配置部分就是openswan的配置文件/etc/ipsec.conf,/etc/ipsec.secrets，再就是iptables的NAT部分。
1：系统安装略 下面将总部的服务器简称为LS(left server),分支的服务器为RS（right server）.分别安装openswan
apt-get install openswan
说明：
1:Do you wish to enable opportunistic encryption in Openswan? 选：no
2:Do you want to create a RSA public/private keypair for this host ? 选：no
如上操作后，退出
2：创建编辑/etc/ipsec.conf,/etc/ipsec.secrets,如无特别说明，都是双机上同时操作。
rm /dev/random
ln -s /dev/urandom /dev/random
ipsec newhostkey --output /etc/ipsec.secrets
注意：rm和ln -s的目的是为了第三步的ipsec操作节省时间。详细的关于/dev/random和/dev/urandom.见参考链接2，google关键字是：/dev/random /dev/urandom 区别
另可以通过 man urandom找到相关信息。
样例文件/etc/ipsec.secrets
: RSA {
# RSA 2192 bits kook.glfsoft.com Fri Sep 7 18:30:22 2007
# for signatures only, UNSAFE FOR ENCRYPTION
#pubkey=0sAQO8thd0/Khbyv6h77C/cCN/RT5g96clCaRggRMv6gDOUwCoMspjLhbuSBQaMcFauCjd25sDKQcHSiNzGRo2c6dq9r3hGWz3p5RGIqA+ro/L/LRWgHa6xH++NPV1AZ/6wwxZ+HC15SymagsrJg5OtdbLMhvNT2gN0qGBROl12BGru7WFLNr8zQkoCcL4nx2SgN02S3Xl34S2/eDXRoo7MvMdfrYKzbTf+V5rEe3hxesEudBqssdn8NUbm1mF5piOzbMymTU+NGmzkYbiGDVhQwr9kfIbjhaLtr9ntpI36ISLVKe4PHr+cll25hQn5ZFqmBhYceuvx2G4n2qKIOoBEGDq39pZxqkN1LI2SgD4N1Ez4LZN
Modulus: 0xbcb61774fca85bcafea1efb0bf70237f453e60f7a72509a46081132fea00ce5300a832ca632e16ee48141a31c15ab828dddb9b032907074a2373191a3673a76af6bde1196cf7a7944622a03eae8fcbfcb4568076bac47fbe34f575019ffac30c59f870b5e52ca66a0b2b260e4eb5d6cb321bcd4f680dd2a18144e975d811abbbb5852cdafccd092809c2f89f1d9280dd364b75e5df84b6fde0d7468a3b32f31d7eb60acdb4dff95e6b11ede1c5eb04b9d06ab2c767f0d51b9b5985e6988ecdb33299353e3469b39186e2183561430afd91f21b8e168bb6bf67b69237e8848b54a7b83c7afe725976e61427e5916a98185871ebafc761b89f6a8a20ea011060eadfda59c6a90dd4b2364a00f8375133e0b64d
PublicExponent: 0x03
# everything after this point is secret
PrivateExponent: 0x1f73ae937f7164a1d51afd481fe805ea8b8a657e9bdb819b656ad887fc5577b8801c08771087ae7d0c0359b2f58f1eb17a4f448086d6813705e8842f09134691d3ca502ee77e9bee0bb0700a726d4caa1e0e6abe7476154a5e28e8d59aa9cb2cb9a9681e50dcc66701dc8657b7c8f921ddaf4ce29157a31aeae0d193a402f1f49e40dccf2a222c3156ac8bd34c4d7816891d2d04e651894997e073fca08ddb0611937457af8669e994345473a0aed4a01b2017f5a326cba2f28969870f4c0783eb47fb376444e9674e00ae01dda55480ebed2e8af1d16670c978a5d5ca8a0fc508f92e8990d85e8225f247a6662ef19dcf80d3304c3d92784170d1aac26cc256aa5d9b11adfebeaf353ca0d31e4c2fbbf80b
Prime1: 0xe09a487c9a72d977226e6f810f53ef0748dace2b75e8e300bd94a5fbfdfd1e0bc0381534d55441600abe3b7f8177a74740c68404f23ca49c76c1f4d0793f58ef5f0d5d7aae3e83558449c9c239c065d3809aa7259e316be4448029e74c392365508d2166da5a6c7c1b9b817d6e836e9ef986cadfea3a019ef3f3e90bf853b7dea7d580f6fe9e53009d
Prime2: 0xd71762d7273d7c8879f958f88c2b554a4bb3d04c69e8161483bc199bbb80c6e617bb16ccfcb4b7cd9f64ca158697a2a4e0463837d463f712728ffd0a52fbccc37ef6ccb4b4d174b4deba82a9698fb4db62148e03a9fb4a8d9ca517b213e9469d15ecddc57693f8ff515d0c8081c65f42ebb01e929998e142b4c373891d08df183666848a897725e571
Exponent1: 0x95bc305311a1e64f6c499fab5f8d4a04db3c89724e9b42007e631952a953695d2ad00e2338e2d64007297cffaba51a2f808458034c286dbda4814de050d4e5f4ea08e8fc7429ace3ad8686817bd59937ab11c4c3becb9d42d8557144dd7b6cee35b36b99e6e6f2fd67bd00fe49acf469fbaf31ea9c26abbf4d4d4607fae27a946fe3ab4f54698cab13
Exponent2: 0x8f64ec8f6f7e5305a6a63b505d7238dc3277e032f145640dad2811127d00849965276488a8787a8914eddc0e59ba6c6dead97acfe2ed4f61a1b5535c3752888254a48878788ba3233f2701c6465fcde796b85ead1bfcdc5e686e0fcc0d462f1363f33e83a462a5ff8b935dab012eea2c9d201461bbbb40d7232cf7b0be05ea102444585c5ba4c3ee4b
Coefficient: 0x8dad8bbc23387a2237593246b204be082fd21c61d65ffa0319b208bab95dee4a2e47e82fff7b8033201d8c17e6901923e7eba59cbf74162b49e5ca01f88986cc691680dafdea6d3be3e06f4f88e2de4f496171193bb4a63b0d776b15f4d675b98646590b40d58b3f55cd2034c1c2e521459aacecef5103b5c6f38535b9367ea3f4ca7dc79426b3e383
}
# do not change the indenting of that "}"
下面创建/etc/ipsec.conf文件，如果你对于ssh的不用密码登录，并且做过集群的用户等效的话，这里的配置文件创建方式是类似的。
下面的文件是双机一样的。样例文件如下：
version 2.0
include /etc/ipsec.d/examples/no_oe.conf
config setup
nat_traversal=yes
plutostderrlog=/var/log/pluto.log
conn test
keyingtries=%forever
authby=rsasig
auto=start
left=222.92.109.231
leftsubnet=192.168.80.0/24
leftnexthop=222.92.109.225
leftrsasigkey=0sAQOPAsHPXj2/glopuY+KCsHvZS8QpMzsRS7NmjjgtQxJALyoyetV+/8+iT8EFWArelly2iC2LtK3ZWEgW1nS92qHJdeuX+vVX6dwdhxIodcfP7Lti73MadZnmU+JQRLUsHYK9u+pbJGksIrOIgMJnWsxrwpK4kGp5GuRWtpd13EuJkPWb+3lbpaofX9JwsLSgn0q+ZD5nccwhaiXTshDCT/UinE9teqoO7JbVvmooPcjEWktsnJ22u9gbs0m6KeGthx9TJJPGg0fZKWXVhuID+Mv2zdUwwPVk5EHjKeZ5f74+D9YSxJxITcEBMtDQTrH87RPyz8bX/q5Qq1iZ56JbjPdPm0+knvgLRYDLBPSRIylUs5p
right=61.155.208.3
rightsubnet=192.168.101.0/24
rightnexthop=61.155.208.1
rightrsasigkey=0sAQO8thd0/Khbyv6h77C/cCN/RT5g96clCaRggRMv6gDOUwCoMspjLhbuSBQaMcFauCjd25sDKQcHSiNzGRo2c6dq9r3hGWz3p5RGIqA+ro/L/LRWgHa6xH++NPV1AZ/6wwxZ+HC15SymagsrJg5OtdbLMhvNT2gN0qGBROl12BGru7WFLNr8zQkoCcL4nx2SgN02S3Xl34S2/eDXRoo7MvMdfrYKzbTf+V5rEe3hxesEudBqssdn8NUbm1mF5piOzbMymTU+NGmzkYbiGDVhQwr9kfIbjhaLtr9ntpI36ISLVKe4PHr+cll25hQn5ZFqmBhYceuvx2G4n2qKIOoBEGDq39pZxqkN1LI2SgD4N1Ez4LZN
文件比较简单，很容易看懂。下面简单介绍一下主要字段的产生。这个配置文件，结合上门的那个图看一下。是非常容易的。
主要介绍leftrsasigkey、rightrsasigkey的产生方法。注意匹配。避免在left server上产生right key的情况。
root@LS:~# ipsec showhostkey --left
# RSA 2192 bits dmz-nat Fri Sep 7 18:32:24 2007
leftrsasigkey=0sAQOPAsHPXj2/glopuY+KCsHvZS8QpMzsRS7NmjjgtQxJALyoyetV+/8+iT8EFWArelly2iC2LtK3ZWEgW1nS92qHJdeuX+vVX6dwdhxIodcfP7Lti73MadZnmU+JQRLUsHYK9u+pbJGksIrOIgMJnWsxrwpK4kGp5GuRWtpd13EuJkPWb+3lbpaofX9JwsLSgn0q+ZD5nccwhaiXTshDCT/UinE9teqoO7JbVvmooPcjEWktsnJ22u9gbs0m6KeGthx9TJJPGg0fZKWXVhuID+Mv2zdUwwPVk5EHjKeZ5f74+D9YSxJxITcEBMtDQTrH87RPyz8bX/q5Qq1iZ56JbjPdPm0+knvgLRYDLBPSRIylUs5p
root@RS:~# ipsec showhostkey --right
# RSA 2192 bits kook.glfsoft.com Fri Sep 7 18:30:22 2007
rightrsasigkey=0sAQO8thd0/Khbyv6h77C/cCN/RT5g96clCaRggRMv6gDOUwCoMspjLhbuSBQaMcFauCjd25sDKQcHSiNzGRo2c6dq9r3hGWz3p5RGIqA+ro/L/LRWgHa6xH++NPV1AZ/6wwxZ+HC15SymagsrJg5OtdbLMhvNT2gN0qGBROl12BGru7WFLNr8zQkoCcL4nx2SgN02S3Xl34S2/eDXRoo7MvMdfrYKzbTf+V5rEe3hxesEudBqssdn8NUbm1mF5piOzbMymTU+NGmzkYbiGDVhQwr9kfIbjhaLtr9ntpI36ISLVKe4PHr+cll25hQn5ZFqmBhYceuvx2G4n2qKIOoBEGDq39pZxqkN1LI2SgD4N1Ez4LZN
至于本机地址ifconfig获取吧。上层网关可以，rounte -n,或者netstat -nr都可以。但是，我发现我的ADSL的网关很奇怪。只能通过ifconfig去找到它。
下面那个P-t-P:221.225.48.1就是了。
root@RS:~# ifconfig
eth0 Link encap:Ethernet HWaddr 00:0B:6A:DF:B5:AC
inet addr:192.168.101.56 Bcast:192.168.101.255 Mask:255.255.255.0
inet6 addr: fe80::20b:6aff:fedf:b5ac/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:81153 errors:0 dropped:0 overruns:0 frame:0
TX packets:52649 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:16653279 (15.8 MiB) TX bytes:11039593 (10.5 MiB)
Interrupt:201 Base address:0x2f00
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:0 (0.0 b) TX bytes:0 (0.0 b)
ppp0 Link encap:Point-to-Point Protocol
inet addr:221.225.48.25 P-t-P:221.225.48.1 Mask:255.255.255.255
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1492 Metric:1
RX packets:21954 errors:0 dropped:0 overruns:0 frame:0
TX packets:27591 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:3
RX bytes:7751933 (7.3 MiB) TX bytes:3933420 (3.7 MiB)
启动服务的相关命令：/etc/init.d/ipsec start | stop ｜ restart | status
3:iptables的Nat调整。双向都要修改。
估计很多人的NAT都是简单方式，如下：
-A POSTROUTING -o eth0 -j MASQUERADE
-A POSTROUTING -o ppp0 -j MASQUERADE
需要修改为
-A POSTROUTING -s 192.168.80.0/255.255.255.0 -d ! 192.168.101.0/255.255.255.0 -o eth0 -j MASQUERADE
-A POSTROUTING -s 192.168.101.0/255.255.255.0 -d ! 192.168.80.0/255.255.255.0 -o ppp0 -j MASQUERADE
样例文件如下：
1:Left Server的iptabels-save文件。
# Generated by iptables-save v1.3.3 on Fri Sep 7 21:24:26 2007
*filter
:INPUT ACCEPT [140622:6765274]
:FORWARD ACCEPT [30212:2076096]
:OUTPUT ACCEPT [250897:56479961]
COMMIT
# Completed on Fri Sep 7 21:24:26 2007
# Generated by iptables-save v1.3.3 on Fri Sep 7 21:24:26 2007
*nat
:PREROUTING ACCEPT [11567:739516]
:POSTROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [110:32696]
-A POSTROUTING -s 192.168.80.0/255.255.255.0 -d ! 192.168.101.0/255.255.255.0 -o eth0 -j MASQUERADE
COMMIT
# Completed on Fri Sep 7 21:24:26 2007
2:Right Server的iptables-save文件
# Generated by iptables-save v1.3.3 on Mon Sep 10 10:02:37 2007
*nat
:PREROUTING ACCEPT [18:2527]
:POSTROUTING ACCEPT [1:108]
:OUTPUT ACCEPT [1:108]
-A POSTROUTING -s 192.168.101.0/255.255.255.0 -d ! 192.168.80.0/255.255.255.0 -o ppp0 -j MASQUERADE
COMMIT
# Completed on Mon Sep 10 10:02:37 2007
# Generated by iptables-save v1.3.3 on Mon Sep 10 10:02:37 2007
*filter
:INPUT ACCEPT [56:7136]
:FORWARD ACCEPT [11:676]
:OUTPUT ACCEPT [20:1856]
-A FORWARD -o ppp0 -p tcp -m tcp --tcp-flags SYN,RST SYN -m tcpmss --mss 1400:1536 -j TCPMSS --clamp-mss-to-pmtu
COMMIT
# Completed on Mon Sep 10 10:02:37 2007
对了，记得打开内核的转发。如果你本来已经做Nat的话，肯定已经修改了。双机执行如下：
root@LS:~# vi /etc/sysctl.conf
......
net/ipv4/ip_forward=1
......
root@LS:~# sysctl -p
4：查看状态,参考链接1.日志文件/var/log/pluto.log，及相关命令。
root@LS:~# tail -f /var/log/pluto.log
root@LS:~# ipsec barf (产生超多信息，barf是呕吐的意思，估计把能吐的都吐了。呵呵。)
root@LS:~# ipsec auto --status
root@LS:~# tcpdump -n -i eth0 icmp
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes
06:11:36.835395 IP 192.168.101.24 > 192.168.80.10: ICMP echo request, id 768, seq 4909, length 40
06:11:37.827897 IP 192.168.101.24 > 192.168.80.10: ICMP echo request, id 768, seq 5165, length 40
06:11:38.819993 IP 192.168.101.24 > 192.168.80.10: ICMP echo request, id 768, seq 5421, length 40
06:11:39.833482 IP 192.168.101.24 > 192.168.80.10: ICMP echo request, id 768, seq 5677, length 40
06:11:40.840780 IP 192.168.101.24 > 192.168.80.10: ICMP echo request, id 768, seq 5933, length 40
06:11:41.877138 IP 192.168.101.24 > 192.168.80.10: ICMP echo request, id 768, seq 6189, length 40
06:11:42.877428 IP 192.168.101.24 > 192.168.80.10: ICMP echo request, id 768, seq 6445, length 40
06:11:43.882809 IP 192.168.101.24 > 192.168.80.10: ICMP echo request, id 768, seq 6701, length 40
06:11:44.875519 IP 192.168.101.24 > 192.168.80.10: ICMP echo request, id 768, seq 6957, length 40
06:11:45.831237 IP 192.168.101.24 > 192.168.80.10: ICMP echo request, id 768, seq 7213, length 40
06:11:46.856197 IP 192.168.101.24 > 192.168.80.10: ICMP echo request, id 768, seq 7469, length 40
06:11:47.853919 IP 192.168.101.24 > 192.168.80.10: ICMP echo request, id 768, seq 7725, length 40
root@RS:~# tcpdump -n -i ppp0 icmp
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on ppp0, link-type LINUX_SLL (Linux cooked), capture size 96 bytes
18:11:56.725896 IP 192.168.80.10 > 192.168.101.24: ICMP echo reply, id 768, seq 30252, length 40
18:11:57.584298 IP 192.168.80.10 > 192.168.101.24: ICMP echo request, id 55062, seq 5, length 64
18:11:57.726368 IP 192.168.80.10 > 192.168.101.24: ICMP echo reply, id 768, seq 30508, length 40
18:11:58.594890 IP 192.168.80.10 > 192.168.101.24: ICMP echo request, id 55062, seq 6, length 64
18:11:58.728961 IP 192.168.80.10 > 192.168.101.24: ICMP echo reply, id 768, seq 30764, length 40
18:11:59.593563 IP 192.168.80.10 > 192.168.101.24: ICMP echo request, id 55062, seq 7, length 64
18:11:59.729572 IP 192.168.80.10 > 192.168.101.24: ICMP echo reply, id 768, seq 31020, length 40
18:12:00.604153 IP 192.168.80.10 > 192.168.101.24: ICMP echo request, id 55062, seq 8, length 64
18:12:00.732140 IP 192.168.80.10 > 192.168.101.24: ICMP echo reply, id 768, seq 31276, length 40
18:12:01.604707 IP 192.168.80.10 > 192.168.101.24: ICMP echo request, id 55062, seq 9, length 64
18:12:01.732756 IP 192.168.80.10 > 192.168.101.24: ICMP echo reply, id 768, seq 31532, length 40
18:12:02.615272 IP 192.168.80.10 > 192.168.101.24: ICMP echo request, id 55062, seq 10, length 64
18:12:02.735372 IP 192.168.80.10 > 192.168.101.24: ICMP echo reply, id 768, seq 31788, length 40
18:12:03.623941 IP 192.168.80.10 > 192.168.101.24: ICMP echo request, id 55062, seq 11, length 64
18:12:03.735966 IP 192.168.80.10 > 192.168.101.24: ICMP echo reply, id 768, seq 32044, length 40
有趣的事情：当我采用了错误的iptable策略时，无法ping通，重新使用正确的策略，仍然无法ping通。
但是我换一个内网地址ping的话，就立即ping通了。奇怪的现象。需要想想为什么。
本文链接：http://www.52zhe.cn/read.php/94.htm
本文作者：kook（若就博客内所涉及的技术问题交流，请用下面的MSN或Gmail联系我)
联系方式：(MSN:kook#live.com) (Google talk:kookliu)
没有版权：GNU，转载时请注明“转载人”欠本人一顿饭，来日见面之时兑现！谢谢合作！
